<!DOCTYPE html>
<!--[if IE 8]><html class="no-js lt-ie9"  lang="en" dir="ltr" prefix="og: http://ogp.me/ns#"> <![endif]-->
<!--[if gt IE 8]><!--> <html class="no-js"  lang="en" dir="ltr" prefix="og: http://ogp.me/ns#"> <!--<![endif]-->
  <head>
    <meta charset="utf-8" />
<link rel="shortcut icon" href="https://www.usenix.org/themes/motherboard/favicon.ico" type="image/vnd.microsoft.icon" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<meta name="citation_title" content="Morphuzz: Bending (Input) Space to Fuzz Virtual Devices" />
<meta name="citation_author" content="Alexander Bulekov" />
<meta name="citation_author_institution" content="Boston University and Red Hat" />
<meta name="citation_author_email" content="alxndr@bu.edu" />
<meta name="citation_author" content="Bandan Das" />
<meta name="citation_author_institution" content="Red Hat" />
<meta name="citation_author_email" content="bsd@redhat.com" />
<meta name="citation_author" content="Stefan Hajnoczi" />
<meta name="citation_author_institution" content="Red Hat" />
<meta name="citation_author_email" content="stefanha@redhat.com" />
<meta name="citation_author" content="Manuel Egele" />
<meta name="citation_author_institution" content="Boston University" />
<meta name="citation_author_email" content="megele@bu.edu" />
<meta name="citation_publication_date" content="2022" />
<meta name="citation_conference_title" content="31st USENIX Security Symposium (USENIX Security 22)" />
<meta name="citation_firstpage" content="1221" />
<meta name="citation_lastpage" content="1238" />
<meta name="citation_isbn" content="978-1-939133-31-1" />
<meta name="citation_pdf_url" content="https://www.usenix.org/system/files/sec22-bulekov.pdf" />
    <title>Morphuzz: Bending (Input) Space to Fuzz Virtual Devices | USENIX</title>
    <style media="all">
@import url("https://www.usenix.org/core/misc/normalize.css?t2lus1");
@import url("https://www.usenix.org/core/modules/system/css/system.css?t2lus1");
@import url("https://www.usenix.org/core/modules/system/css/messages.theme.css?t2lus1");
</style>
<style media="all">
@import url("https://www.usenix.org/core/modules/comment/css/comment.css?t2lus1");
@import url("https://www.usenix.org/core/modules/date/css/date.css?t2lus1");
@import url("https://www.usenix.org/core/modules/field/css/field.css?t2lus1");
@import url("https://www.usenix.org/modules/contrib/og/css/og.css?t2lus1");
@import url("https://www.usenix.org/modules/contrib/paragraphs/css/paragraphs.css?t2lus1");
@import url("https://www.usenix.org/modules/custom/usenix_conference/css/timezone-picker.css?t2lus1");
@import url("https://www.usenix.org/modules/custom/usenix_logo_preview/css/usenix_logo_preview.css?t2lus1");
@import url("https://www.usenix.org/core/modules/user/css/user.css?t2lus1");
@import url("https://www.usenix.org/modules/contrib/workflow/workflow_admin_ui/workflow_admin_ui.css?t2lus1");
@import url("https://www.usenix.org/core/modules/views/css/views.css?t2lus1");
@import url("https://www.usenix.org/modules/contrib/rules/rules.css?t2lus1");
</style>
<style media="all">
@import url("https://www.usenix.org/modules/contrib/geshifilter/geshifilter.css?t2lus1");
@import url("https://www.usenix.org/modules/custom/biblio/biblio.css?t2lus1");
</style>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.4.0/css/font-awesome.min.css" media="all" />
<style media="all">
@import url("https://www.usenix.org/modules/contrib/tb_megamenu/css/bootstrap.css?t2lus1");
@import url("https://www.usenix.org/modules/contrib/tb_megamenu/css/base.css?t2lus1");
@import url("https://www.usenix.org/modules/contrib/tb_megamenu/css/default.css?t2lus1");
@import url("https://www.usenix.org/modules/contrib/tb_megamenu/css/compatibility.css?t2lus1");
@import url("https://www.usenix.org/core/modules/system/css/menu-dropdown.theme.breakpoint.css?t2lus1");
</style>
<style media="all and (min-width: 60em)">
@import url("https://www.usenix.org/core/modules/system/css/menu-dropdown.theme.breakpoint-queries.css?t2lus1");
</style>
<style media="all">
@import url("https://www.usenix.org/themes/neat_conference/css/neat.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-atc.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-atc_colo.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-atc_colo_dark.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-enigma.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-enigma_temp.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-fast.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-lisa_lean.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-lisa.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-lisa_blue.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-lisa_red.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-lisa_green.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-nsdi.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-osdi.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-security.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-security_colo.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-soups.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-srecon.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/css/schemes/scheme-pepr_woot.css?t2lus1");
@import url("https://www.usenix.org/themes/neat_conference/fonts/fontawesome/css/all.min.css?t2lus1");
</style>
    <script>window.Backdrop = {settings: {"basePath":"\/","pathPrefix":"","drupalCompatibility":true,"ajaxPageState":{"theme":"neat_conference","theme_token":"RiOAO3jJX20XfOVA7sKtwMs-0wrrV8pm-BRPuxrBnSQ","css":{"core\/misc\/normalize.css":1,"core\/modules\/system\/css\/system.css":1,"core\/modules\/system\/css\/system.theme.css":1,"core\/modules\/system\/css\/messages.theme.css":1,"core\/modules\/comment\/css\/comment.css":1,"core\/modules\/date\/css\/date.css":1,"core\/modules\/field\/css\/field.css":1,"modules\/contrib\/og\/css\/og.css":1,"modules\/contrib\/paragraphs\/css\/paragraphs.css":1,"core\/modules\/search\/search.theme.css":1,"modules\/custom\/usenix_conference\/css\/timezone-picker.css":1,"modules\/custom\/usenix_logo_preview\/css\/usenix_logo_preview.css":1,"core\/modules\/user\/css\/user.css":1,"modules\/contrib\/workflow\/workflow_admin_ui\/workflow_admin_ui.css":1,"core\/modules\/views\/css\/views.css":1,"modules\/contrib\/rules\/rules.css":1,"modules\/contrib\/geshifilter\/geshifilter.css":1,"modules\/custom\/biblio\/biblio.css":1,"layouts\/neat_conference\/neat-conference.css":1,"https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/font-awesome\/4.4.0\/css\/font-awesome.min.css":1,"modules\/contrib\/tb_megamenu\/css\/bootstrap.css":1,"modules\/contrib\/tb_megamenu\/css\/base.css":1,"modules\/contrib\/tb_megamenu\/css\/default.css":1,"modules\/contrib\/tb_megamenu\/css\/compatibility.css":1,"core\/modules\/system\/css\/menu-dropdown.theme.breakpoint.css":1,"core\/modules\/system\/css\/menu-dropdown.theme.breakpoint-queries.css":1,"themes\/neat_conference\/css\/neat.css":1,"themes\/neat_conference\/css\/schemes\/scheme-atc.css":1,"themes\/neat_conference\/css\/schemes\/scheme-atc_colo.css":1,"themes\/neat_conference\/css\/schemes\/scheme-atc_colo_dark.css":1,"themes\/neat_conference\/css\/schemes\/scheme-enigma.css":1,"themes\/neat_conference\/css\/schemes\/scheme-enigma_temp.css":1,"themes\/neat_conference\/css\/schemes\/scheme-fast.css":1,"themes\/neat_conference\/css\/schemes\/scheme-lisa_lean.css":1,"themes\/neat_conference\/css\/schemes\/scheme-lisa.css":1,"themes\/neat_conference\/css\/schemes\/scheme-lisa_blue.css":1,"themes\/neat_conference\/css\/schemes\/scheme-lisa_red.css":1,"themes\/neat_conference\/css\/schemes\/scheme-lisa_green.css":1,"themes\/neat_conference\/css\/schemes\/scheme-nsdi.css":1,"themes\/neat_conference\/css\/schemes\/scheme-osdi.css":1,"themes\/neat_conference\/css\/schemes\/scheme-security.css":1,"themes\/neat_conference\/css\/schemes\/scheme-security_colo.css":1,"themes\/neat_conference\/css\/schemes\/scheme-soups.css":1,"themes\/neat_conference\/css\/schemes\/scheme-srecon.css":1,"themes\/neat_conference\/css\/schemes\/scheme-pepr_woot.css":1,"themes\/neat_conference\/fonts\/fontawesome\/css\/all.min.css":1,"themes\/neat_conference\/system.theme.css":1},"js":{"public:\/\/google_tag\/google_tag.script.js":1,"modules\/contrib\/jquery_update\/replace\/jquery\/1.12\/jquery.min.js":1,"core\/misc\/jquery.once.js":1,"core\/misc\/backdrop.js":1,"modules\/contrib\/behavior_weights\/js\/behavior_weights.js":1,"modules\/contrib\/jquery_update\/js\/jquery_browser.js":1,"modules\/contrib\/beautytips\/js\/jquery.bt.min.js":1,"modules\/contrib\/beautytips\/js\/beautytips.js":1,"modules\/contrib\/views_slideshow\/js\/views_slideshow.js":1,"modules\/contrib\/views_slideshow\/contrib\/views_slideshow_cycle\/js\/formoptions.js":1,"modules\/contrib\/views_slideshow\/contrib\/views_slideshow_cycle\/js\/views_slideshow_cycle.js":1,"modules\/contrib\/beautytips\/other_libs\/jquery.hoverIntent.minified.js":1,"modules\/contrib\/field_group\/js\/field_group.js":1,"modules\/contrib\/field_group\/js\/field_groups.js":1,"modules\/contrib\/tb_megamenu\/js\/tb-megamenu-frontend.js":1,"modules\/contrib\/tb_megamenu\/js\/tb-megamenu-touch.js":1,"core\/modules\/system\/js\/menus.js":1,"themes\/neat_conference\/js\/bibtex.js":1,"themes\/neat_conference\/js\/mobile.js":1,"themes\/neat_conference\/js\/jquery.slicknav.min.js":1,"themes\/neat_conference\/js\/tech-schedule.js":1,"themes\/neat_conference\/js\/training-program.js":1,"themes\/neat_conference\/js\/organizers.js":1,"themes\/neat_conference\/js\/protected-files.js":1}},"ajaxcomments":{"offsets":{"selector":"","custom_offset":0}},"beautytipStyles":{"default":[],"plain":[],"netflix":{"positions":["right","left"],"fill":"#FFF","padding":5,"shadow":true,"shadowBlur":12,"strokeStyle":"#B9090B","spikeLength":50,"spikeGirth":20,"cornerRadius":10,"centerPointY":0.1,"overlap":-8,"cssStyles":{"fontSize":"12px","fontFamily":"arial,helvetica,sans-serif"}},"facebook":{"fill":"#F7F7F7","padding":8,"strokeStyle":"#B7B7B7","cornerRadius":0,"cssStyles":{"fontFamily":"\u0022lucida grande\u0022,tahoma,verdana,arial,sans-serif","fontSize":"11px"}},"transparent":{"fill":"rgba(0, 0, 0, .8)","padding":20,"strokeStyle":"#CC0","strokeWidth":3,"spikeLength":40,"spikeGirth":40,"cornerRadius":40,"cssStyles":{"color":"#FFF","fontWeight":"bold"}},"big-green":{"fill":"#00FF4E","padding":20,"strokeWidth":0,"spikeLength":40,"spikeGirth":40,"cornerRadius":15,"cssStyles":{"fontFamily":"\u0022lucida grande\u0022,tahoma,verdana,arial,sans-serif","fontSize":"14px"}},"google-maps":{"positions":["top","bottom"],"fill":"#FFF","padding":15,"strokeStyle":"#ABABAB","strokeWidth":1,"spikeLength":65,"spikeGirth":40,"cornerRadius":25,"centerPointX":0.9,"cssStyles":{"fontSize":"12px","fontFamily":"arial,helvetica,sans-serif"}},"hulu":{"fill":"#F4F4F4","strokeStyle":"#666666","spikeLength":20,"spikeGirth":10,"width":350,"overlap":0,"centerPointY":1,"cornerRadius":0,"cssStyles":{"fontFamily":"\u0022Lucida Grande\u0022,Helvetica,Arial,Verdana,sans-serif","fontSize":"12px","padding":"10px 14px"},"shadow":true,"shadowColor":"rgba(0,0,0,.5)","shadowBlur":8,"shadowOffsetX":4,"shadowOffsetY":4}},"beautytips":{".beautytips":{"cssSelect":".beautytips","style":null}},"field_group":{"div":"full"}}};</script>
<script defer="defer" src="https://www.usenix.org/sites/default/files/google_tag/google_tag.script.js?t2lus1"></script>
<script src="https://www.usenix.org/modules/contrib/jquery_update/replace/jquery/1.12/jquery.min.js?t2lus1"></script>
<script src="https://www.usenix.org/core/misc/jquery.once.js?v=1.2.6"></script>
<script src="https://www.usenix.org/core/misc/backdrop.js?v=1.30.2"></script>
<script src="https://www.usenix.org/modules/contrib/behavior_weights/js/behavior_weights.js?v=1.x-1.0"></script>
<script src="https://www.usenix.org/modules/contrib/jquery_update/js/jquery_browser.js?v=0.0.1"></script>
<script src="https://www.usenix.org/modules/contrib/beautytips/js/jquery.bt.min.js?v=0.9.5-rc1"></script>
<script src="https://www.usenix.org/modules/contrib/beautytips/js/beautytips.js?v=1.x-2.x"></script>
<script src="https://www.usenix.org/modules/contrib/views_slideshow/js/views_slideshow.js?t2lus1"></script>
<script src="https://www.usenix.org/modules/contrib/views_slideshow/contrib/views_slideshow_cycle/js/formoptions.js?t2lus1"></script>
<script src="https://www.usenix.org/modules/contrib/views_slideshow/contrib/views_slideshow_cycle/js/views_slideshow_cycle.js?t2lus1"></script>
<script src="https://www.usenix.org/modules/contrib/beautytips/other_libs/jquery.hoverIntent.minified.js?t2lus1"></script>
<script src="https://www.usenix.org/modules/contrib/field_group/js/field_group.js?t2lus1"></script>
<script src="https://www.usenix.org/modules/contrib/field_group/js/field_groups.js?t2lus1"></script>
<script src="https://www.usenix.org/modules/contrib/tb_megamenu/js/tb-megamenu-frontend.js?t2lus1"></script>
<script src="https://www.usenix.org/modules/contrib/tb_megamenu/js/tb-megamenu-touch.js?t2lus1"></script>
<script src="https://www.usenix.org/core/modules/system/js/menus.js?v=1.30.2"></script>
<script src="https://www.usenix.org/themes/neat_conference/js/bibtex.js?t2lus1"></script>
<script src="https://www.usenix.org/themes/neat_conference/js/mobile.js?t2lus1"></script>
<script src="https://www.usenix.org/themes/neat_conference/js/jquery.slicknav.min.js?t2lus1"></script>
<script src="https://www.usenix.org/themes/neat_conference/js/tech-schedule.js?t2lus1"></script>
<script src="https://www.usenix.org/themes/neat_conference/js/training-program.js?t2lus1"></script>
<script src="https://www.usenix.org/themes/neat_conference/js/organizers.js?t2lus1"></script>
<script src="https://www.usenix.org/themes/neat_conference/js/protected-files.js?t2lus1"></script>

  </head>
  <body class="page node-type-paper scheme-security user-is-non-member">
    <div class="layout--neat_conference" id="page-wrapper"><div id="page">
<div role="document" class="page">
  <header id="site-header" class="site-header">
    <div class="usenix-login-bar">
        <section class="block block-usenix-login-bar-usenix-login-bar-block usenix-login-bar-block block-usenix-login-bar">

  
  <a href="/" id="site-logo" class="site-logo"><svg id="back-to-usenix" class="back-to-usenix" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 162.57 52.34"><title>usenix_logo_notag_white</title><path class="cls-1" d="M51,5.76h2.15V18.7h-1.5l-.46-1.09A9.63,9.63,0,0,1,46.58,19a4.7,4.7,0,0,1-1.85-.33,3.26,3.26,0,0,1-1.22-.83,3.75,3.75,0,0,1-.69-1.26,6.54,6.54,0,0,1-.34-1.46c0-.46-.07-1-.07-1.59V5.76h2.15v7.88q0,3.39,2.95,3.39A7.67,7.67,0,0,0,51,16Z" transform="translate(-3.49 -4.33)"/><path class="cls-1" d="M68.56,5.51h.52l.47,0,.39,0,.38.05.31.06.33.08.28.07.31.09.29.09L71.3,7.68a11.79,11.79,0,0,0-3.09-.48,5.5,5.5,0,0,0-1.37.16,3,3,0,0,0-.92.38,2,2,0,0,0-.52.52,1.7,1.7,0,0,0-.26.52,1.73,1.73,0,0,0-.06.43,1.19,1.19,0,0,0,.56,1,4.59,4.59,0,0,0,1.39.68q.83.26,1.8.62t1.8.76A3.81,3.81,0,0,1,72,13.33,2.65,2.65,0,0,1,72.57,15a4,4,0,0,1-.14,1,3.47,3.47,0,0,1-.52,1.05,3.69,3.69,0,0,1-1,1,5.5,5.5,0,0,1-1.63.66,9.47,9.47,0,0,1-2.34.26,11.68,11.68,0,0,1-4.4-1l.6-1.62a21.61,21.61,0,0,0,2.21.71,7.12,7.12,0,0,0,1.68.21q3.2,0,3.19-2a1.13,1.13,0,0,0-.31-.79,2.3,2.3,0,0,0-.84-.55c-.35-.14-.74-.29-1.18-.45S67,13.16,66.54,13a8.33,8.33,0,0,1-1.35-.52A7.73,7.73,0,0,1,64,11.81a2.83,2.83,0,0,1-.84-1,3,3,0,0,1-.31-1.39,3.22,3.22,0,0,1,.15-1,3.45,3.45,0,0,1,.56-1,4.28,4.28,0,0,1,1-1,5.38,5.38,0,0,1,1.64-.68A9.19,9.19,0,0,1,68.56,5.51Z" transform="translate(-3.49 -4.33)"/><path class="cls-1" d="M87.43,5.51a5.79,5.79,0,0,1,1.7.23,4.37,4.37,0,0,1,1.25.58,3.19,3.19,0,0,1,.86.92,5.56,5.56,0,0,1,.55,1.1,6.45,6.45,0,0,1,.29,1.28c.07.5.12.93.13,1.3s0,.8,0,1.3v1H83.34a3.35,3.35,0,0,0,.32,1.41,4.2,4.2,0,0,0,2.44,2.23,5.77,5.77,0,0,0,2.1.37,10.37,10.37,0,0,0,2.95-.47l.38,1.47a12.71,12.71,0,0,1-4.14.72,7.83,7.83,0,0,1-2.53-.38,5.19,5.19,0,0,1-1.78-1A5,5,0,0,1,82,16.14a6.46,6.46,0,0,1-.6-1.7,9.39,9.39,0,0,1-.16-1.79A9.42,9.42,0,0,1,81.56,10a6.44,6.44,0,0,1,1-2,6.13,6.13,0,0,1,1.41-1.38,5.66,5.66,0,0,1,1.69-.82A6.53,6.53,0,0,1,87.43,5.51ZM87,7.37A3.18,3.18,0,0,0,85,8a3.67,3.67,0,0,0-1.21,1.58,5.34,5.34,0,0,0-.38,2h6.76Q90.15,7.37,87,7.37Z" transform="translate(-3.49 -4.33)"/><path class="cls-1" d="M101.66,5.76h1.51l.47,1.1a9.71,9.71,0,0,1,4.56-1.36,4.68,4.68,0,0,1,1.85.34,3.2,3.2,0,0,1,1.22.84,3.7,3.7,0,0,1,.69,1.27,6.78,6.78,0,0,1,.33,1.46,15,15,0,0,1,.07,1.58V18.7H110.2V10.84q0-3.4-2.93-3.4a7.66,7.66,0,0,0-3.46,1V18.7h-2.15Z" transform="translate(-3.49 -4.33)"/><path class="cls-1" d="M122.42,5.76h2.15V18.7h-2.15Z" transform="translate(-3.49 -4.33)"/><path class="cls-1" d="M133.14,5.76h2.49l3.65,5.13,3.52-5.13h2.29l-4.77,6.6,4.52,6.34h-2.49l-3.47-4.86-3.3,4.86H133.3l4.53-6.35Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M69.67,37.24c-.15-.39-.29-.77-.42-1.15l-.4-1.15H64.77L64,37.24H62.64q.52-1.43,1-2.64t.89-2.31q.44-1.09.86-2.08t.9-2h1.16q.47,1,.9,2t.86,2.08q.44,1.09.89,2.31t1,2.64ZM68.49,33.9q-.42-1.13-.83-2.19t-.85-2q-.45,1-.86,2t-.81,2.19Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M76.78,36.35q2,0,2-1.35a1.36,1.36,0,0,0-.18-.71,1.72,1.72,0,0,0-.47-.51,3.31,3.31,0,0,0-.68-.37l-.81-.31a8.43,8.43,0,0,1-.94-.38,3.31,3.31,0,0,1-.77-.51,2.13,2.13,0,0,1-.51-.7A2.55,2.55,0,0,1,75,28.69,3.4,3.4,0,0,1,77.24,28a5.86,5.86,0,0,1,1.49.18,3.38,3.38,0,0,1,1,.38l-.4,1a3.57,3.57,0,0,0-.81-.33,4.4,4.4,0,0,0-1.25-.16,2.8,2.8,0,0,0-.68.08,1.74,1.74,0,0,0-.55.23,1.16,1.16,0,0,0-.37.4,1.12,1.12,0,0,0-.14.57,1.2,1.2,0,0,0,.14.61,1.4,1.4,0,0,0,.4.44,3.48,3.48,0,0,0,.6.34q.34.16.76.31.58.23,1.07.47a3.5,3.5,0,0,1,.85.56,2.24,2.24,0,0,1,.55.77,2.71,2.71,0,0,1,.2,1.09,2.12,2.12,0,0,1-.86,1.82,4.05,4.05,0,0,1-2.44.64,6.11,6.11,0,0,1-1-.07,7.26,7.26,0,0,1-.8-.17,4.42,4.42,0,0,1-.6-.21L74,36.8l.38-1a5.45,5.45,0,0,0,.91.38A4.62,4.62,0,0,0,76.78,36.35Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M85.91,36.35q2,0,2-1.35a1.36,1.36,0,0,0-.17-.71,1.73,1.73,0,0,0-.47-.51,3.36,3.36,0,0,0-.68-.37l-.81-.31a8.37,8.37,0,0,1-.94-.38,3.29,3.29,0,0,1-.77-.51,2.14,2.14,0,0,1-.51-.7,2.55,2.55,0,0,1,.62-2.82A3.4,3.4,0,0,1,86.37,28a5.86,5.86,0,0,1,1.49.18,3.36,3.36,0,0,1,1,.38l-.4,1a3.59,3.59,0,0,0-.81-.33,4.41,4.41,0,0,0-1.25-.16,2.79,2.79,0,0,0-.68.08,1.75,1.75,0,0,0-.55.23,1.18,1.18,0,0,0-.37.4,1.13,1.13,0,0,0-.14.57,1.2,1.2,0,0,0,.14.61,1.39,1.39,0,0,0,.4.44,3.47,3.47,0,0,0,.6.34l.76.31q.58.23,1.07.47a3.52,3.52,0,0,1,.84.56,2.22,2.22,0,0,1,.55.77,2.72,2.72,0,0,1,.2,1.09,2.12,2.12,0,0,1-.87,1.82,4.05,4.05,0,0,1-2.44.64,6.1,6.1,0,0,1-1-.07,7.19,7.19,0,0,1-.8-.17,4.47,4.47,0,0,1-.6-.21l-.4-.19.38-1a5.48,5.48,0,0,0,.91.38A4.63,4.63,0,0,0,85.91,36.35Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M92.58,32.73a5.58,5.58,0,0,1,.34-2,4.23,4.23,0,0,1,.94-1.48,3.87,3.87,0,0,1,1.38-.89,4.66,4.66,0,0,1,1.67-.3,4.52,4.52,0,0,1,1.64.3,3.83,3.83,0,0,1,1.36.89,4.29,4.29,0,0,1,.93,1.48,6.25,6.25,0,0,1,0,4.08,4.3,4.3,0,0,1-.93,1.47,3.83,3.83,0,0,1-1.36.89,4.53,4.53,0,0,1-1.64.3,4.66,4.66,0,0,1-1.67-.3,3.87,3.87,0,0,1-1.38-.89,4.24,4.24,0,0,1-.94-1.47A5.58,5.58,0,0,1,92.58,32.73Zm1.33,0a5,5,0,0,0,.21,1.49,3.32,3.32,0,0,0,.59,1.14,2.59,2.59,0,0,0,.94.72,3,3,0,0,0,1.24.25,2.92,2.92,0,0,0,1.24-.25,2.61,2.61,0,0,0,.93-.72,3.36,3.36,0,0,0,.59-1.14,5.43,5.43,0,0,0,0-3A3.34,3.34,0,0,0,99,30.11a2.6,2.6,0,0,0-.93-.72,2.91,2.91,0,0,0-1.24-.25,2.94,2.94,0,0,0-1.24.25,2.57,2.57,0,0,0-.94.72,3.31,3.31,0,0,0-.59,1.14A5,5,0,0,0,93.9,32.73Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M109.14,37.44a4.59,4.59,0,0,1-1.73-.31,3.65,3.65,0,0,1-1.34-.91,4.13,4.13,0,0,1-.86-1.47,6.08,6.08,0,0,1-.3-2,5.47,5.47,0,0,1,.34-2,4.38,4.38,0,0,1,.93-1.48,3.94,3.94,0,0,1,1.37-.91,4.44,4.44,0,0,1,1.66-.31,5.82,5.82,0,0,1,1,.08,6.12,6.12,0,0,1,.78.18,3.76,3.76,0,0,1,.54.21l.29.16-.36,1a2,2,0,0,0-.34-.17l-.5-.18a4.53,4.53,0,0,0-.61-.15,3.82,3.82,0,0,0-.67-.06,3.22,3.22,0,0,0-1.29.25,2.65,2.65,0,0,0-1,.71,3.23,3.23,0,0,0-.62,1.14,4.87,4.87,0,0,0-.21,1.5,5.4,5.4,0,0,0,.19,1.47,3.24,3.24,0,0,0,.57,1.14,2.54,2.54,0,0,0,.94.73,3.13,3.13,0,0,0,1.32.26,4.84,4.84,0,0,0,1.44-.18,6.24,6.24,0,0,0,.86-.32l.33,1a1.81,1.81,0,0,1-.33.16,4.21,4.21,0,0,1-.58.19,7.28,7.28,0,0,1-.82.16A7.45,7.45,0,0,1,109.14,37.44Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M115.54,28.24h1.26v9h-1.26Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M127.26,37.24c-.15-.39-.29-.77-.42-1.15l-.4-1.15h-4.08l-.82,2.3h-1.31q.52-1.43,1-2.64t.89-2.31c.29-.73.58-1.42.86-2.08s.59-1.32.9-2H125q.47,1,.9,2t.87,2.08q.44,1.09.89,2.31t1,2.64Zm-1.18-3.34q-.41-1.13-.83-2.19t-.85-2q-.45,1-.87,2t-.81,2.19Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M137.26,28.24v1.09h-2.83v7.92h-1.26V29.33h-2.83V28.24Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M140.8,28.24h1.26v9H140.8Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M146.14,32.73a5.6,5.6,0,0,1,.34-2,4.21,4.21,0,0,1,.94-1.48,3.86,3.86,0,0,1,1.38-.89,4.66,4.66,0,0,1,1.67-.3,4.53,4.53,0,0,1,1.65.3,3.84,3.84,0,0,1,1.36.89,4.26,4.26,0,0,1,.93,1.48,6.21,6.21,0,0,1,0,4.08,4.27,4.27,0,0,1-.93,1.47,3.85,3.85,0,0,1-1.36.89,4.53,4.53,0,0,1-1.65.3,4.67,4.67,0,0,1-1.67-.3,3.86,3.86,0,0,1-1.38-.89,4.22,4.22,0,0,1-.94-1.47A5.6,5.6,0,0,1,146.14,32.73Zm1.33,0a5,5,0,0,0,.21,1.49,3.37,3.37,0,0,0,.59,1.14,2.62,2.62,0,0,0,.94.72,3,3,0,0,0,1.24.25,2.91,2.91,0,0,0,1.23-.25,2.6,2.6,0,0,0,.93-.72,3.32,3.32,0,0,0,.59-1.14,5.43,5.43,0,0,0,0-3,3.31,3.31,0,0,0-.59-1.14,2.58,2.58,0,0,0-.93-.72,2.9,2.9,0,0,0-1.23-.25,3,3,0,0,0-1.24.25,2.61,2.61,0,0,0-.94.72,3.36,3.36,0,0,0-.59,1.14A5,5,0,0,0,147.47,32.73Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M165,37.24l-.66-1.08q-.37-.6-.8-1.24l-.89-1.31c-.31-.44-.61-.87-.92-1.28s-.6-.8-.88-1.16-.55-.68-.79-1v7h-1.24v-9h1q.61.65,1.31,1.51t1.38,1.78q.68.92,1.29,1.8t1,1.57V28.24h1.24v9Z" transform="translate(-3.49 -4.33)"/><g class="cls-3"><g class="cls-3"><path class="cls-2" d="M13.17,36.8a48.25,48.25,0,0,0,4.95,2.13,32.82,32.82,0,0,1,1.2-4.83c-2.27-1-2.67-1.25-4.88-2.42A35.56,35.56,0,0,0,13.17,36.8ZM32.35,8A29.28,29.28,0,0,0,27,4.33a36.84,36.84,0,0,0-4.35,3A41.79,41.79,0,0,1,28,11,36.51,36.51,0,0,1,32.35,8ZM23.71,15c-.82-.59-1.93-1.36-2.77-1.93A49.91,49.91,0,0,0,17,18L14.4,16.29a43.54,43.54,0,0,1,8.23-9,20.77,20.77,0,0,0-4.54-1.88,42.13,42.13,0,0,0-4,3.79c.58.25,1.33.6,1.89.87a47.94,47.94,0,0,0-3.8,4.74l-1.73-1.08C7.95,17.43.19,30.2,5.07,41.21l0,0h0l.13.23c2.24,3.88,5.84,5.09,9.65,4.82l.32,0a27,27,0,0,1-.1-7.92,38.56,38.56,0,0,1-4.15-2.1,38.28,38.28,0,0,1,1.64-6.54,47,47,0,0,1-4-2.76c.38-1,.93-2.37,1.35-3.38,1.68,1.22,2.08,1.48,4,2.73-.43,1-1,2.38-1.36,3.41,1.56.94,1.85,1.1,4.1,2.3a46.4,46.4,0,0,1,2.93-6.54c-1.67-1-1.89-1.16-4-2.51.56-1,1.34-2.26,1.94-3.21l3.95,2.6a43,43,0,0,1,8.65-9.65c-.62-.53-1.48-1.23-2.12-1.75A45.3,45.3,0,0,0,23.71,15Z" transform="translate(-3.49 -4.33)"/><path class="cls-2" d="M50.57,32.9s-2.4-2.08-9.83-5.94c-2.38-.92-3.08.42-4.47,3.07C29.22,43.56,10.85,54.52,4.06,42.1c.49.88,1.16,2,1.7,2.89a33.94,33.94,0,0,0,4.86,5.07c1,.85,2.45,1.94,3.55,2.71A27.08,27.08,0,0,0,18.31,55c1.17.46,2.75,1,4,1.39,9.72,2,21.13-6.1,28.39-20,.82-2,.21-3.08-.09-3.44" transform="translate(-3.49 -4.33)"/></g></g></svg>
</a><div class="item-list"><ul id="usenix-login-bar-links" class="usenix-login-bar-links"><li class="login odd first"><a href="/user/login?destination=conference/usenixsecurity22/presentation/bulekov">Sign In</a></li><li class="conference even last"><a href="/conferences">Conferences</a></li></ul></div>
</section>    </div>
    <div class="usenix-announcement-banner-region">
          </div>
    <div class="outer-wrapper">
      <div class="header-col2-wrapper">
              </div>
      <div class="header-col1-wrapper">
          <section class="block block-usenix-og-auto-menu-usenix-og-auto-header-menu-logo">

  
  <a href="/conf%C3%A9rence/usenixsecurity22" class="header-menu-logo-link"><img class="header-menu-logo" src="https://www.usenix.org/sites/default/files/styles/neat_conference_menu_logo/public/sec22_wordmark_stacked_white_400x164_rev.png" width="102" height="42" alt="" /></a>
</section>  <section class="block block-usenix-og-auto-menu-usenix-og-auto-header-menu">

  
  <div  class="tb-megamenu tb-megamenu-menu-og-259192" role="navigation" aria-label="Main navigation">
      <button data-target=".nav-collapse" data-toggle="collapse" class="btn btn-navbar tb-megamenu-button" type="button">
      <i class="fa fa-reorder"></i>
    </button>
    <div class="nav-collapse  always-show">
    <ul  class="tb-megamenu-nav nav level-0 items-5">
    <li  data-id="45507" data-level="1" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-1 mega dropdown">
          <a href="/conf%C3%A9rence/usenixsecurity22#registration"  class="dropdown-toggle">
                Attend                      </a>
        <div  data-class="" data-width="" class="tb-megamenu-submenu dropdown-menu mega-dropdown-menu nav-child">
  <div class="mega-dropdown-inner">
    <div  class="tb-megamenu-row row-fluid">
  <div  data-class="" data-width="4" data-hidewcol="0" id="tb-megamenu-column-1" class="tb-megamenu-column span4  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-4">
    <li  data-id="45508" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/registration-information" >
                Registration Information                      </a>
          </li>

  <li  data-id="45509" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/registration-discounts" >
                Registration Discounts                      </a>
          </li>

  <li  data-id="45510" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/terms" >
                Terms and Conditions                      </a>
          </li>

  <li  data-id="45511" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/grants" >
                Grant Opportunities                      </a>
          </li>
</ul>
  </div>
</div>

<div  data-class="" data-width="4" data-hidewcol="" id="tb-megamenu-column-2" class="tb-megamenu-column span4  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-1">
    <li  data-id="45512" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/venue-hotel-and-travel" >
                Venue, Hotel, and Travel                      </a>
          </li>
</ul>
  </div>
</div>
</div>
  </div>
</div>
  </li>

  <li  data-id="44354" data-level="1" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-1 mega dropdown">
          <a href="/conf%C3%A9rence/usenixsecurity22/technical-sessions"  class="dropdown-toggle">
                Program                      </a>
        <div  data-class="" data-width="" class="tb-megamenu-submenu dropdown-menu mega-dropdown-menu nav-child">
  <div class="mega-dropdown-inner">
    <div  class="tb-megamenu-row row-fluid">
  <div  data-class="" data-width="4" data-hidewcol="0" id="tb-megamenu-column-3" class="tb-megamenu-column span4  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-1">
    <li  data-id="45523" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conf%C3%A9rence/usenixsecurity22/technical-sessions" >
                Technical Sessions                      </a>
          </li>
</ul>
  </div>
</div>

<div  data-class="" data-width="4" data-hidewcol="" id="tb-megamenu-column-4" class="tb-megamenu-column span4  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-3">
    <li  data-id="44355" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/summer-accepted-papers" >
                Summer Accepted Papers                      </a>
          </li>

  <li  data-id="45450" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/fall-accepted-papers" >
                Fall Accepted Papers                      </a>
          </li>

  <li  data-id="45513" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/winter-accepted-papers" >
                Winter Accepted Papers                      </a>
          </li>
</ul>
  </div>
</div>

<div  data-class="" data-width="4" data-hidewcol="" id="tb-megamenu-column-5" class="tb-megamenu-column span4  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-2">
    <li  data-id="45537" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/activities" >
                Activities                      </a>
          </li>

  <li  data-id="45540" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/poster-session" >
                Poster Session and Happy Hour                      </a>
          </li>
</ul>
  </div>
</div>
</div>
  </div>
</div>
  </li>

  <li  data-id="43627" data-level="1" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-1 mega dropdown">
          <a href="/conference/usenixsecurity22/call-for-papers"  class="dropdown-toggle">
                Participate                      </a>
        <div  data-class="" data-width="" class="tb-megamenu-submenu dropdown-menu mega-dropdown-menu nav-child">
  <div class="mega-dropdown-inner">
    <div  class="tb-megamenu-row row-fluid">
  <div  data-class="" data-width="4" data-hidewcol="0" id="tb-megamenu-column-6" class="tb-megamenu-column span4  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-2">
    <li  data-id="43628" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/call-for-papers" >
                Call for Papers                      </a>
          </li>

  <li  data-id="43629" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/submission-policies-and-instructions" >
                Submission Policies and Instructions                      </a>
          </li>
</ul>
  </div>
</div>

<div  data-class="" data-width="4" data-hidewcol="" id="tb-megamenu-column-7" class="tb-megamenu-column span4  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-2">
    <li  data-id="43835" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/call-for-artifacts" >
                Call for Artifacts                      </a>
          </li>

  <li  data-id="43836" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/artifact-appendix-guidelines" >
                Artifact Appendix Guidelines                      </a>
          </li>
</ul>
  </div>
</div>

<div  data-class="" data-width="4" data-hidewcol="" id="tb-megamenu-column-8" class="tb-megamenu-column span4  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-1">
    <li  data-id="43834" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/instructions-presenters" >
                Instructions for Presenters                      </a>
          </li>
</ul>
  </div>
</div>
</div>
  </div>
</div>
  </li>

  <li  data-id="43626" data-level="1" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-1 mega dropdown">
          <a href="/conf%C3%A9rence/usenixsecurity22#sponsorship"  class="dropdown-toggle">
                Sponsors                      </a>
        <div  data-class="" data-width="" class="tb-megamenu-submenu dropdown-menu mega-dropdown-menu nav-child">
  <div class="mega-dropdown-inner">
    <div  class="tb-megamenu-row row-fluid">
  <div  data-class="" data-width="12" data-hidewcol="0" id="tb-megamenu-column-9" class="tb-megamenu-column span12  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-1">
    <li  data-id="45532" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conference/usenixsecurity22/exhibitor-services" >
                Exhibitor Services                      </a>
          </li>
</ul>
  </div>
</div>
</div>
  </div>
</div>
  </li>

  <li  data-id="43620" data-level="1" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-1 mega dropdown">
          <a href="/conf%C3%A9rence/usenixsecurity22#marquee"  class="dropdown-toggle">
                About                      </a>
        <div  data-class="" data-width="" class="tb-megamenu-submenu dropdown-menu mega-dropdown-menu nav-child">
  <div class="mega-dropdown-inner">
    <div  class="tb-megamenu-row row-fluid">
  <div  data-class="" data-width="6" data-hidewcol="0" id="tb-megamenu-column-10" class="tb-megamenu-column span6  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-2">
    <li  data-id="43621" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conf%C3%A9rence/usenixsecurity22#organizers" >
                Symposium Organizers                      </a>
          </li>

  <li  data-id="43622" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="https://www.usenix.org/conferences/byname/108" >
                Past Symposia                      </a>
          </li>
</ul>
  </div>
</div>

<div  data-class="" data-width="6" data-hidewcol="" id="tb-megamenu-column-11" class="tb-megamenu-column span6  mega-col-nav">
  <div class="tb-megamenu-column-inner mega-inner clearfix">
        <ul  class="tb-megamenu-subnav mega-nav level-1 items-3">
    <li  data-id="43623" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="https://www.usenix.org/policies" >
                Conference Policies                      </a>
          </li>

  <li  data-id="43624" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="https://www.usenix.org/conferences/coc" >
                Code of Conduct                      </a>
          </li>

  <li  data-id="43625" data-level="2" data-type="menu_item" data-class="" data-xicon="" data-caption="" data-alignsub="" data-group="0" data-hidewcol="0" data-hidesub="0" header_hide="0" footer_hide="0" id="" style="" class="tb-megamenu-item level-2 mega">
          <a href="/conf%C3%A9rence/usenixsecurity22#questions" >
                Questions                      </a>
          </li>
</ul>
  </div>
</div>
</div>
  </div>
</div>
  </li>
</ul>
      </div>
  </div>

</section>      </div>
    </div>
  </header>
  
  <main role="main">

    <section id="content">
              <div class="outer-wrapper">
                      <h1 id="page-title">Morphuzz: Bending (Input) Space to Fuzz Virtual Devices</h1>
                  </div>
      
      
      
      <article id="node-277149" class="node node-paper view-mode-full">

        
  
  <div class="content">
    <div class="field field-name-field-paper-people-text field-type-text-long field-label-above"><div class="field-label">Authors:&nbsp;</div><div class="field-items field-items"><div class="field-item odd"><p>Alexander Bulekov, <em>Boston University and Red Hat;</em> Bandan Das and Stefan Hajnoczi, <em>Red Hat;</em> Manuel Egele, <em>Boston University</em></p></div></div></div><div class="field field-name-field-paper-description field-type-text-long field-label-above"><div class="field-label">Abstract:&nbsp;</div><div class="field-items field-items"><div class="field-item odd"><p>The security of the entire cloud ecosystem crucially depends on the isolation guarantees that hypervisors provide between guest VMs and the host system. To allow VMs to communicate with their environment, hypervisors provide a slew of virtual-devices including network interface cards and performance-optimized VIRTIO-based SCSI adapters. As these devices sit directly on the hypervisor's isolation boundary and accept potentially attacker controlled input (e.g., from a malicious cloud tenant), bugs and vulnerabilities in the devices' implementations have the potential to render the hypervisor's isolation guarantees moot. Prior works applied fuzzing to simple virtual-devices, focusing on a narrow subset of the vast input-space and the state-of-the-art virtual-device fuzzer, Nyx, requires precise, manually-written, specifications to exercise complex devices.</p><p>In this paper we present MORPHUZZ, a generic approach that leverages insights about hypervisor design combined with coverage-guided fuzzing to find bugs in virtual device implementations. Crucially MORPHUZZ does not rely on expert knowledge specific to each device. MORPHUZZ is the first approach that automatically elicits the complex I/O behaviors of the real-world virtual devices found in modern clouds. To demonstrate this capability, we implemented MORPHUZZ in QEMU and bhyve and fuzzed 33 different virtual devices (a superset of the 16 devices analyzed by prior work). Additionally, we show that MORPHUZZ is not tied to a specific CPU architecture, by fuzzing 3 additional ARM devices. MORPHUZZ matches or exceeds coverage obtained by Nyx, for 13/16 virtual devices, and identified a superset (110) of all crashes reported by Nyx (44). We reported all newly discovered bugs to the respective developers. Notably, MORPHUZZ achieves this without initial seed-inputs, or expert guidance.</p></div></div></div><div class="field field-name-field-paper-people field-type-node-reference field-label-hidden"><div class="field-items field-items"><div class="field-item odd"><article id="node-283373" class="node node-speaker view-mode-schedule">

  
  <div class="content">
      </div>

        
    
</article>
</div><div class="field-item even"><article id="node-283374" class="node node-speaker view-mode-schedule">

  
  <div class="content">
      </div>

        
    
</article>
</div><div class="field-item odd"><article id="node-283375" class="node node-speaker view-mode-schedule">

  
  <div class="content">
      </div>

        
    
</article>
</div><div class="field-item even"><article id="node-283376" class="node node-speaker view-mode-schedule">

  
  <div class="content">
      </div>

        
    
</article>
</div></div></div><div id="node-paper-full-group-open-access-content" class=" group-open-access-content field-group-div"><h2><span>Open Access Media</span></h2><div class="description"><p>USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. <a href="/annual-fund">Support USENIX</a> and our commitment to Open Access.</p>
</div><div class="field field-name-field-bibtex-node field-type-node-reference field-label-hidden"><div class="field-items field-items"><div class="field-item odd"><div class="bibtex-accordion"><div class="bibtex-accordion-label">BibTeX</div><div class="bibtex-accordion-content"><div class="bibtex-text-entry bibtex-accordion-text-entry">@inproceedings {277148,<br />
	author = {Alexander Bulekov and Bandan Das and Stefan Hajnoczi and Manuel Egele},<br />
	title = {Morphuzz: Bending (Input) Space to Fuzz Virtual Devices},<br />
	booktitle = {31st USENIX Security Symposium (USENIX Security 22)},<br />
	year = {2022},<br />
	isbn = {978-1-939133-31-1},<br />
	address = {Boston, MA},<br />
	pages = {1221--1238},<br />
	url = {https://www.usenix.org/conference/usenixsecurity22/presentation/bulekov},<br />
	publisher = {USENIX Association},<br />
	month = aug<br />
}<br />
</div><div class="bibtex-download-link bibtex-accordion-download-link"><a href="/biblio/export/bibtex/277148">Download</a></div></div></div></div></div></div><div class="field field-name-field-final-paper-pdf field-type-file field-label-hidden"><div class="field-items field-items"><div class="field-item odd"><span class="file"><img class="file-icon" alt="PDF icon" title="application/pdf" src="/core/modules/file/icons/application-pdf.png" /> <a href="https://www.usenix.org/system/files/sec22-bulekov.pdf" type="application/pdf; length=737432" title="sec22-bulekov.pdf">Bulekov PDF</a></span></div><div class="field-item even"><span class="file"><img class="file-icon" alt="PDF icon" title="application/pdf" src="/core/modules/file/icons/application-pdf.png" /> <a href="https://www.usenix.org/system/files/usenixsecurity22-bulekov.pdf" type="application/pdf; length=333464" title="usenixsecurity22-bulekov.pdf">Bulekov Appendix PDF</a></span></div></div></div><div class="field field-name-field-presentation-pdf field-type-file field-label-hidden"><div class="field-items field-items"><div class="field-item odd"><span class="file"><img class="file-icon" alt="PDF icon" title="application/pdf" src="/core/modules/file/icons/application-pdf.png" /> <a href="https://www.usenix.org/system/files/sec22summer_bulekov.pdf" type="application/pdf; length=466832" title="sec22summer_bulekov.pdf">Bulekov Paper (Prepublication) PDF</a></span></div></div></div><div class="field field-name-field-artifact-evaluated field-type-taxonomy-term-reference field-label-hidden"><div class="field-items field-items"><div class="field-item odd"><img src="https://www.usenix.org/sites/default/files/usenix_artifact_evaluation_available_125_update.png" width="125" height="125" alt="" title="" /></div><div class="field-item even"><img src="https://www.usenix.org/sites/default/files/usenix_artifact_evaluation_functional_125.png" width="125" height="125" alt="" title="" /></div></div></div><h2 class="field field-name-field-embed-video field-type-video-embed-field field-label-above"><span class="field-label">Presentation Video&nbsp;</span><span class="field-item odd first last">
<div class="embedded-video">
  <div class="player">
    <iframe title="YouTube video" class="large-12 medium-12 small-12 columns usenix-schedule-media" width="745" height="420" src="//www.youtube.com/embed/BRezYTVGvJQ?width%3D745%26amp%3Bheight%3D420%26amp%3Btheme%3Ddark%26amp%3Bautoplay%3D0%26amp%3Bvq%3Dhd720%26amp%3Brel%3D0%26amp%3Bshowinfo%3D0%26amp%3Bmodestbranding%3D0%26amp%3Biv_load_policy%3D1%26amp%3Bcontrols%3D1%26amp%3Bautohide%3D2%26amp%3Bwmode%3Dopaque" frameborder="0" allowfullscreen></iframe>  </div>
</div>
</span></h2></div>  </div>

        
    
</article>
    </section>

  </main>

      <footer id="site-footer" role="contentinfo" class="site-footer">
              <section class="footer-top">
            <section class="block block-usenix-og-auto-menu-usenix-og-auto-footer-menu">

  
  <ul class="menu"><li class="first expanded has-children menu-mlid-45507"><a href="/conf%C3%A9rence/usenixsecurity22#registration">Attend</a><ul><li class="first leaf menu-mlid-45508"><a href="/conference/usenixsecurity22/registration-information">Registration Information</a></li>
<li class="leaf menu-mlid-45509"><a href="/conference/usenixsecurity22/registration-discounts">Registration Discounts</a></li>
<li class="leaf menu-mlid-45510"><a href="/conference/usenixsecurity22/terms">Terms and Conditions</a></li>
<li class="leaf menu-mlid-45511"><a href="/conference/usenixsecurity22/grants">Grant Opportunities</a></li>
<li class="last leaf menu-mlid-45512"><a href="/conference/usenixsecurity22/venue-hotel-and-travel">Venue, Hotel, and Travel</a></li>
</ul></li>
<li class="expanded has-children menu-mlid-44354"><a href="/conf%C3%A9rence/usenixsecurity22/technical-sessions">Program</a><ul><li class="first leaf menu-mlid-45523"><a href="/conf%C3%A9rence/usenixsecurity22/technical-sessions">Technical Sessions</a></li>
<li class="leaf menu-mlid-44355"><a href="/conference/usenixsecurity22/summer-accepted-papers">Summer Accepted Papers</a></li>
<li class="leaf menu-mlid-45450"><a href="/conference/usenixsecurity22/fall-accepted-papers">Fall Accepted Papers</a></li>
<li class="leaf menu-mlid-45513"><a href="/conference/usenixsecurity22/winter-accepted-papers">Winter Accepted Papers</a></li>
<li class="leaf menu-mlid-45537"><a href="/conference/usenixsecurity22/activities">Activities</a></li>
<li class="last leaf menu-mlid-45540"><a href="/conference/usenixsecurity22/poster-session">Poster Session and Happy Hour</a></li>
</ul></li>
<li class="expanded has-children menu-mlid-43627"><a href="/conference/usenixsecurity22/call-for-papers">Participate</a><ul><li class="first leaf menu-mlid-43628"><a href="/conference/usenixsecurity22/call-for-papers">Call for Papers</a></li>
<li class="leaf menu-mlid-43629"><a href="/conference/usenixsecurity22/submission-policies-and-instructions">Submission Policies and Instructions</a></li>
<li class="leaf menu-mlid-43835"><a href="/conference/usenixsecurity22/call-for-artifacts">Call for Artifacts</a></li>
<li class="leaf menu-mlid-43836"><a href="/conference/usenixsecurity22/artifact-appendix-guidelines">Artifact Appendix Guidelines</a></li>
<li class="last leaf menu-mlid-43834"><a href="/conference/usenixsecurity22/instructions-presenters">Instructions for Presenters</a></li>
</ul></li>
<li class="expanded has-children menu-mlid-43626"><a href="/conf%C3%A9rence/usenixsecurity22#sponsorship">Sponsors</a><ul><li class="first last leaf menu-mlid-45532"><a href="/conference/usenixsecurity22/exhibitor-services">Exhibitor Services</a></li>
</ul></li>
<li class="last expanded has-children menu-mlid-43620"><a href="/conf%C3%A9rence/usenixsecurity22#marquee">About</a><ul><li class="first leaf menu-mlid-43621"><a href="/conf%C3%A9rence/usenixsecurity22#organizers">Symposium Organizers</a></li>
<li class="leaf menu-mlid-43622"><a href="https://www.usenix.org/conferences/byname/108">Past Symposia</a></li>
<li class="leaf menu-mlid-43623"><a href="https://www.usenix.org/policies">Conference Policies</a></li>
<li class="leaf menu-mlid-43624"><a href="https://www.usenix.org/conferences/coc">Code of Conduct</a></li>
<li class="last leaf menu-mlid-43625"><a href="/conf%C3%A9rence/usenixsecurity22#questions">Questions</a></li>
</ul></li>
</ul>
</section>        </section>
                    <section class="footer-bottom">
            <section class="block block-usenix-conference-og-conference-social-icon">

  
  <article id="node-259192" class="node node-conference view-mode-social-icon">

  <div class="content">
    <a href="https://twitter.com/usenixsecurity" target="_blank"><span class="fab fa-x-twitter"></span><span class="offscreen">Twitter</span></a><a href="https://www.facebook.com/USENIX-Security-Symposium-13544602263" target="_blank"><span class="fab fa-facebook-f"></span><span class="offscreen">Facebook</span></a><a href="https://www.youtube.com/user/USENIXAssociation" target="_blank"><span class="fab fa-youtube"></span><span class="offscreen">Youtube</span></a>  </div>

</article>

</section>  <section class="block block-menu-menu-footer" role="navigation">

  
  <ul class="menu-tree menu" data-menu-style="tree" data-clickdown="0" data-collapse="default"><li class="first leaf menu-mlid-2774"><a href="/privacy-policy">Privacy Policy</a></li>
<li class="last leaf menu-mlid-2775"><a href="/contact">Contact Us</a></li>
</ul>
</section>  <section class="block block-block-27">

  
  <div style="padding-top: .25em;">
	<p style="color: inherit;">&copy; USENIX <script>new Date().getFullYear()>document.write(new Date().getFullYear());</script><br>
        EIN 13-3055038</p>
</div>
</section>        </section>
          </footer>
  </div>
      <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'97f65140ccb6b8ab',t:'MTc1NzkyMDM2Mw=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body>
</html>
